CVE-2024-38909

EPSS 0.19%
Published 30.07.2024 14:15:02
Last modified 28.04.2025 14:35:52
Source cve@mitre.org
Teams watchlist Login
Open Login

Studio 42 elFinder 2.1.64 is vulnerable to Incorrect Access Control. Copying files with an unauthorized extension between server directories allows an arbitrary attacker to expose secrets, perform RCE, etc.

Affected products Warnungen 0 Metrics 2 CWE 1 References 5

Data is provided by the National Vulnerability Database (NVD)

Std42 ≫ Elfinder Version2.1.64

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.19%	0.408

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
134c704f-9b21-4f2e-91b3-4a467353bcc0	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

http://elfinder.com

Permissions Required

https://github.com/B0D0B0P0T/CVE/blob/main/CVE-2024-38909

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2024-38909

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2024-38909

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2024-38909

EUVD